Show My Score Privacy Policy

1) Scope & Who We Are

This Privacy Policy applies to the Show My Score website, web app, and related services (collectively, the "Services"). "We," "our," and "us" mean the Show My Score operating entity. "You" means the user (or a parent/guardian acting on behalf of a minor) and any visitor.

2) Key Principles

• User control: You decide if and when to make your profile or a specific score visible through a shareable URL or QR code. You can revoke public visibility at any time from settings.
• No selling or advertising "sharing": We do not sell your personal information and do not share it for cross‑context behavioral advertising.
• Recruiters never browse the database: Recruiters use Show My Score to deliver job advertisements to audiences defined by verified academic traits. Their interface to the platform is buying ad delivery — they do not have tools to search, query, browse, or filter individual students. They never receive your personal information except in an application you choose to submit to them.
• Data minimization: We aim to collect only what we need for purposes such as verifying scores, running the Service, and keeping it secure.
• Security by design: We apply industry‑standard protections in an effort to keep your data safe.
• Transparency & rights: We provide controls designed to let you access, correct, export, or delete your data, and to withdraw consent for optional features.

3) Information We Collect

3.1 Information you provide

• Account & profile: information such as your name, email, and other profile details you choose to provide through the Service as features become available.
• Verified scores: SAT scores captured during a verification session you initiate (see Section 4). We currently support SAT verification only.
• Public profile content (optional): information you choose to publish on your public page through the sharing features available in the Service.
• Applications: information you choose to share with a recruiter when you apply to a job advertisement on the Service.
• Communications: messages you send to support or feedback you provide.

3.2 Information collected automatically

• Device & log data: data such as IP address, browser information, device identifiers, pages viewed, links clicked, date/time stamps, and referral URL.
• Cookies & similar tech: strictly necessary cookies for login and security; optional analytics cookies (if enabled). See Section 7.

3.3 Information from third parties (optional)

• Single‑Sign‑On (SSO): when you sign in with a third‑party account (such as Google), we receive basic profile data (such as name and email).

Sensitive data: We do not knowingly collect categories such as financial account numbers, health data, or precise geolocation. Please do not upload these.

4) How Verification Works

Verification is the heart of the Service, and the privacy mechanics matter. Here is what happens:

• You log in to College Board yourself. When you start verification, we open a secure, locked-down browser session that runs on Show My Score infrastructure. Inside that session you log into the College Board site with your own credentials. We never see, store, or transmit your College Board username or password.
• You choose when to capture. Once you are logged into your College Board account, a Show My Score browser extension surfaces a popup asking whether you want to share your official score report. The capture happens only on your explicit click. If you don't click, nothing about your score is shared.
• We extract, validate, and briefly process the source PDF as part of verification. When you consent, we receive the official PDF that College Board generates in your session. We extract score fields (such as your name, score values, and test date), validate authenticity signals (such as watermarks and metadata), and may store the PDF briefly in secure internal storage while processing and validation are completed. The PDF is not made available in your account for later viewing or download and is never displayed to recruiters, redistributed, or shared with any third party.
• After successful processing, we delete the source PDF. We retain the structured score data, verification status, limited processing metadata, and, where used for integrity or fraud-prevention purposes, a one-way hash or similar non-viewable verification record.
• No background access. We do not log in to your College Board account on your behalf at any other time. We do not schedule or automate access to your College Board account, and we do not retrieve or refresh your scores in the background. Every retrieval of your College Board score happens through a session you initiate, in your presence, with your active click.
• The verification claim is ours. What appears on your profile and elsewhere in the Service is Show My Score's structured attestation — for example, "Verified SAT: 1450, verified March 12, 2026." If a recruiter or third party wants to see the source College Board document, they must request it from you directly; we do not provide it.

5) How We Use Your Information

• Provide the Services: purposes such as creating and maintaining your account, verifying scores, and powering your private dashboard or — if you opt in — your public profile.
• Sharing at your direction: generate a unique link or QR to your profile or a specific score card when you explicitly choose to share.
• Deliver job ads to you: if you have verified credentials, you may see job ads from recruiters targeting audiences your credentials are part of. We never tell the recruiter who saw the ad; we never share your personal data with the recruiter at this step. (See Section 8 and Section 14.)
• Process your applications: when you submit an application to a job ad, we deliver the application materials you chose to share to that recruiter. Once an application is delivered, Show My Score does not provide tools for the broader hiring process such as interview scheduling, candidate pipelines, or workflow management. Beyond messages exchanged through the application thread on Show My Score, hiring-related communication and decisions take place on the recruiter's own systems.
• Safety & integrity: uses such as detecting and preventing fraud and abuse, securing accounts, and monitoring system reliability. Verification fraud-detection (designed to assess whether uploads appear to be authentic College Board documents) is a core operational use.
• Communications: send account notices such as verification emails and important service updates, plus optional tips and product updates (you can opt out of optional messages).
• Analytics & product improvement: aggregate and de‑identify usage data to improve features and reliability.
• Legal compliance: comply with laws, enforce our Terms, and respond to lawful requests.

6) Public Profiles, Links & QR Codes (Your Controls)

Sharing is your choice. Your scores and profile are accessible only through the sharing options you choose to use, such as a shareable link or QR code. We do not make your profile broadly searchable to recruiters or the public by default.

Granular controls. You can:

• Make your entire profile public or keep it private.
• Revoke sharing at any time; previously issued links and QRs will stop resolving to your profile through the Service.

Important limitations when you share:

• Link previews & scanners. Messaging apps and social platforms may fetch a preview (such as a title or image) when a link is pasted. Some corporate or security tools may auto‑scan links.
• Copies & screenshots. Others can capture or repost what they see. Revoking a link won't delete copies outside our control.
• Metadata hygiene. We design shareable links and QRs in an effort to avoid embedding personal information such as your name, email, or score in the URL or QR itself. Only the page — when opened by a viewer — displays what you've chosen.

7) Cookies & Similar Technologies

We use:

• Strictly necessary cookies for purposes such as secure login, session continuity, and fraud prevention (these generally cannot be turned off).
• Optional analytics cookies to understand usage and improve the product. We'll ask for your consent where required and will update this policy as any user-facing cookie preference controls are added.

We do not use cookies for cross‑site behavioral advertising of student personal data. When the Service adds new functional cookies (for example, a referral attribution cookie if the referral program launches), we will update this policy and disclose them here.

8) When We Share Your Information

We do not sell or rent your personal data. We share only in scenarios such as:

• At your direction: when you create a public profile, share a link or QR, or submit an application to a recruiter through a job ad.
• With recruiters — applications only. Recruiters never browse, search, or query the student database. The only time a recruiter receives your personal information is when you submit an application to one of their job ads. They receive only what you chose to include in that application.
• Service providers (processors): trusted vendors that support the Service in areas such as hosting, email delivery, analytics (if enabled), content delivery, and security. They are bound by confidentiality and data‑processing terms and may only use data to provide services to us.
• Legal and safety: to comply with the law, court orders, or lawful requests; or to protect the rights, property, or safety of you, us, other users, or the public.
• Business transfers: if we undergo a merger, acquisition, or asset sale, we will provide notice and your choices.

We do not share your personal data for targeted advertising or cross‑promotion. We do not share your College Board score PDF with recruiters or any third party. We use it only within the verification flow described in Section 4, including brief secure storage while processing and validation are completed, and we delete it after successful processing.

9) Data Retention

• Account data and structured score attestations: kept while your account is active.
• Source College Board PDFs: processed transiently as part of verification. They may be stored briefly in secure internal storage while processing and validation are completed, and are deleted after successful processing. They are not retained as part of a user-facing document library or for later download through the Service.
• Public links and QRs: remain active until you revoke them or delete the linked content.
• Logs and security records: retained for a limited period for purposes such as security, analytics (if enabled), and compliance.
• Backups: non-PDF data may persist in encrypted backups for a limited time before being overwritten in the ordinary course.

When you delete data or your account, we work to remove it from active systems and scheduled backups as soon as reasonably possible, subject to technical and legal limits. We may retain de‑identified or aggregated data that cannot reasonably identify you.

10) Your Rights & Choices

10.1 Universal controls for all users

• Edit: update the account and profile details the Service makes available for editing.
• Delete: delete your account.
• Withdraw consent: turn off public sharing at any time.
• Export: contact privacy@showmyscore.com to request a copy of the data we hold about you.
• Correct verification data: if you believe our structured score attestation is inaccurate due to a processing or extraction error, contact privacy@showmyscore.com. We will work with you to re-run verification through a fresh in-session capture and update the structured score data we hold to match the result.

10.2 California residents (CCPA / CPRA)

You have the right to know what personal information we collect, to delete it, to correct it, and to limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioral advertising. There is no discrimination for exercising rights.

To exercise any right, use Settings in the Service, or contact privacy@showmyscore.com. We may ask for information to verify your identity before responding, and we aim to respond within the time period required by applicable law.

10.3 Other jurisdictions

The Service is operated from the United States and is designed for users in the United States. If you access the Service from outside the US, you understand and agree that we process your data in the United States. Where applicable, residents of other jurisdictions may have additional rights under their local laws — please contact privacy@showmyscore.com and we will work with you to honor any rights that apply.

11) Security

Our security program is designed to include, among other things:

• Encryption in transit (such as TLS) and encryption at rest for primary data stores.
• Access controls designed around least‑privilege roles, plus multi-factor authentication for internal access to production systems.
• Logging and monitoring designed to surface suspicious activity for review.
• Vulnerability management practices and periodic security reviews.
• Verification fraud-detection on uploads, designed to flag potentially inauthentic submissions through signals such as watermark and metadata checks.

No method of transmission or storage is 100% secure. We will notify you of a data breach as required by applicable law.

12) Children & Minors

The Services are designed for users 16 years and older. We do not allow children under that age to use the Service. The signup flow is designed to gate users based on self-reported age; those who indicate an age below 16 are blocked from creating an account.

We do not pay any user under 18 years old. This applies to forms of compensation such as referral rewards and verification incentives. Under-18 users can use the Service; payouts (where applicable) are 18+ only.

If you believe a child has provided us with personal data without proper consent, please contact us, and we will take appropriate steps as soon as reasonably possible.

13) Third‑Party Links & Social Sharing

If you share to third‑party sites (such as LinkedIn, Instagram, or X), their terms and privacy policies govern those platforms. We do not control those services. Please review their privacy practices before sharing.

14) Ad Targeting and Automated Systems

Show My Score is an advertising platform for employment opportunities. Recruiters pay to deliver job ads to audiences defined by verified academic traits. The following describes how the targeting and delivery systems are designed to work.

Targeting traits. Recruiters can target ads by traits such as verified score band (for example, top quartile or top half — never an exclusionary numeric floor), school, major, enrollment status, and graduation timing. The trait list is intentionally narrow and is designed to exclude categories such as ethnicity, religion, ZIP code, country of birth, native language, gender, and direct age proxies (including graduation year).

Audience size and stacking. The targeting system is designed to display projected audience size as traits are added, and to disable or warn about deliveries where the audience falls below a minimum threshold or where combinations of traits would produce a de facto exclusionary audience.

Delivery fairness. The delivery system is designed to operate under fairness constraints — actual delivery composition may be monitored against the targeted audience composition, and disparate-delivery patterns may be flagged for review.

No individual data to recruiters. The targeting and delivery system is designed so that recruiters do not learn which specific student saw an ad. Recruiters receive aggregate post-campaign reporting, such as impressions, clicks, applications, audience composition by major and school tier, and fairness metrics. The only individual data a recruiter ever receives is an application a student submitted to them.

Why am I seeing this ad? Where reasonably practicable, ads shown in the Service include a "Why am I seeing this?" link or equivalent disclosure describing the traits the ad was targeted to.

No automated employment decisions about you. Show My Score does not make hiring decisions. We deliver ads; the rest is between you and the recruiter.

No composite ratings of students. We do not generate composite ratings of student performance, such as "candidate quality" scores or "match percentages." We do not provide feedback to recruiters on the "quality" of any individual student. Our role is the delivery of advertisements and the secure transmission of applications you initiate.

15) Changes to This Policy

We may update this policy from time to time to reflect changes in our Services or applicable laws. We will post the updated policy with a new "Effective from" date, and, where appropriate, provide additional notice (such as email or an in‑product banner). Your continued use of the Services after an update means you accept the revised policy. If changes materially affect your rights, we will seek your consent where required by law.

16) Contact

Privacy questions & requests:

Email:  privacy@showmyscore.com

17) California Notice (CCPA/CPRA)

• Categories of personal information collected: examples include identifiers (such as name and email), internet or other electronic network activity information (such as usage logs), education information (such as verified scores), and inferences derived from product analytics.
• Sources: you (directly), your devices, and optional SSO providers.
• Purposes: purposes such as providing and securing the Services, verification, delivering ads, processing applications, communications, and analytics (if enabled).
• Disclosure for a business purpose: to service providers in areas such as hosting, email, security, and analytics, and to recruiters in connection with applications you submit.
• Sale/Sharing: we do not sell or share your personal information for cross‑context behavioral advertising.
• Sensitive personal information: we do not collect sensitive personal information as defined by CPRA unless you voluntarily provide it.
• Your rights and requests: to access, delete, correct, or limit use of sensitive personal information, use Settings or contact privacy@showmyscore.com.